A computer network is a collection of interconnected computing devices that exchange data and share resources. In a packet-based network, such as the Internet, the computing devices communicate data by dividing the data into small blocks called packets. The packets are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
A private network may include a number of devices, such as computers, owned or administered by a single enterprise. These devices may be grouped into a number of site networks, and these sites in turn may be geographically distributed over a wide area. Each site network may include one or more local area networks (LANs) connecting the devices at the particular site.
With the advent of Virtual Private Network (VPN) technology, enterprises can now securely share data between site networks over a public network, such as the Internet. For example, a hub or central VPN site may be the network at the headquarters of the enterprise, while spoke site networks are typically networks at geographically distributed branch offices, sales offices, manufacturing or distribution facilities, or other remote site of the enterprise.
In some instances the remote sites may establish VPN tunnels to hub site or between the remote sites to allow the computing devices within the remote sites to securely communicate with each other or with devices at the hub site through the Internet or another public network infrastructure of a network service provider. A number of communication protocols have been developed for establishing a VPN tunnel. In general, these protocols allow network devices to establish the VPN tunnel as one or more secure data flows across the public network infrastructure. For example, Internet Protocol Security (IPSec) protocols and Secure Sockets Layer (SSL) protocols make use of cryptographic technology to establish network “tunnels.” These tunnels allow packets conforming to other network protocols, such as Internet Protocol (IP) packets, to be encapsulated within encrypted packet streams flowing between the sites.
Commonly, each customer site may include a customer edge router that is coupled via a network link to a corresponding provider edge router within the service provider network. The provider edge routers provide VPN services so that the customer's traffic is securely communicated between the VPN sites through the service provider's network and possibly other intermediate networks. One common form of VPN services provided by the network service provider is a multiprotocol label switching (MPLS) VPN. Specifically, an MPLS VPN utilizes creates label switched paths (LSPs) for carrying the customer's VPN traffic through the intermediate networks via defined paths. That is, the routers of the service provider's network support MPLS and establish LSPs between the customer's sites for carrying the customer's VPN traffic.
Due to increasing importance of network security, it has become common for service providers to deploy security devices at the border between each VPN site and the service provider network or other intermediate public networks connecting the VPN sites. One example of a commonly deployed security device is a firewall network device. A firewall, for example, is typically a dedicated device that is configured to permit or deny traffic flows based on the service provider's security policies.
Conventional firewalls, however, have difficulty applying security services to MPLS traffic for various reasons. For example, MPLS traffic flowing through a firewall typically has no state in the data plane. That is, MPLS traffic consists of MPLS labels attached to encapsulated traffic, such as IP traffic. When passing through the firewall, the MPLS labels attached to MPLS packets typically have no meaning to the firewall. As such, the firewall device is unable to provide stateful analysis of the MPLS traffic, such as application of deep packet inspection using assembled application layer data.
For this reason, service providers commonly deploy a separate firewall device between each customer edge router and the corresponding provider edge router that provides ingress and egress for the MPLS tunnels. In this way, the firewall devices are located entirely outside of the MPLS core of the service provider network and are able to apply firewall policies to Internet-Protocol (IP)-based traffic from each customer site external to the MPLS core. However, deployment of these firewall devices increases the number of devices that the service provider must manage and deploy. This increases the configuration and management burden on the service provider, as well as creates power, thermal, cooling, rack space and other issues for the administrator.